Appendix D Examples of Incidents and Accidents Involving The Flightcrew-Automation Interface

The Entire Report of the FAA Human Factors Team, from which this summary was taken (requires Acrobat viewer)
Computer-Related Incidents with Commercial Aircraft Peter Ladkin at the University of Bielefeld
The MartinAir B767 a non-fatal EFIS failure

A software failure destroyed the first Ariane 5.

Date

Location

Airplane Type

Operator

Description

12/29/72

Miami

L-1011

Eastern Air Lines

Flightcrew members became immersed in an apparently malfunctioning landing gear. Airplane was in control wheel steering mode. Altitude hold inadvertently disengaged by a light force on the control wheel. Altitude alert aural warning not heard by flightcrew. Fatal crash.

7/31/73

Boston

DC-9-31

Delta Air Lines

Airplane landed short during an approach in fog. Flightcrew was preoccupied with questionable information presented by the flight director. Fatal crash

2/28/84

New York

DC-10-30

Scandin-avian Airlines

minor injuries. Complacency and over-reliance on automatic systems cited.

2/19/85

San Francisco

747SP

China Airlines

Loss of power on one engine during autoflight. Autopilot tried to compensate until control limits were reached. Captain disengaged autopilot, airplane went into unusual attitude high speed dive, but was successfully recovered. Autopilot masked approaching onset of loss of control

6/26/88

Habsheim

A320

Air France

Low, slow flyover at air show. Ran out of energy and flew into trees. Possible overconfidence in the envelope protection features of the A320. Fatal crash.

7/3/88

Gatwick

A320

unknown

Programmed for 3 degree flight path, but inadvertently was in vertical speed mode, almost landed 3 miles short.

1/89

Helsinki

A300

KAR Air

While making an ILS approach, the takeoff/go-around lever was inadvertently depressed. In response to the unexpected and sudden nose-up change in the airplane's attitude, the flightcrew immediately reacted by re-trimming.

6/8/89

Boston

767

unknown

On autopilot ILS approach, airplane overshot the localizer. Captain switched from approach to heading select mode to regain the localizer , disengaged the autopilot, and used the flight director. Since the glide slope had not been captured, the flight director was in vertical speed mode commanding an 1,800 fpm rate of descent. Alert from the ground proximity warning and tower resulted in a go-around from about 500 feet.

2/14/90

Bangalore

A320

Indian Airlines

Inappropriate use of open descent mode. Fatal crash.

6/90

San Diego

A320

unknown

Pilot mistakenly set vertical speed of 3,000 fpm instead of 3.0 degree flight path angle. Error was caught, but airplane descended well below profile and minimum descent altitude.

2/11/91

Moscow

A310

Interflug

Pilot intervention in auto-pilot coupled go-around resulted in the autopilot commanding nose-up trim while the pilot was applying nose-down elevator. Autopilot disconnected when mode transitioned to altitude acquire mode - force disconnect not inhibited in this mode as it is in go-around mode. Airplane ended up badly out of trim and went through several extreme pitch oscillations before the flightcrew regained control.

1/20/92

Strasbourg

A320

Air Inter

Evidence suggests flightcrew inadvertently selected 3,300 fpm descent rate on approach instead of 3.3 degree flight path angle. Fatal crash.

9/14/93

Warsaw

A320

Lufthansa

Wet runway, high tailwinds -- After touchdown, the air/ground logic did not indicate the airplane was on the ground, and delayed deployment of ground spoilers and reversers. Airplane overran runway. Two fatalities.

9/13/93

Tahiti

747-400

Air France

VNAV approach with autothrottle engaged, autopilot disengaged. Upon reaching the published missed approach point, VNAV commanded a go-around and the autothrottle advanced power. After a delay, the flightcrew manually reduced power to idle and held the thrust levers in the idle position. The airplane landed long and fast. Two seconds prior to touchdown the number one engine thrust lever advanced to nearly full forward thrust and remained there until the airplane stopped. Reverse thrust was obtained on the other engines. The spoilers were not deployed -- the automatic system did not operate because the number one thrust lever was not at idle, and the flightcrew did not extend them manually. The flightcrew lost directional control of the airplane as the speed decreased and the airplane went off the right side of the runway.

6/6/94

Hong Kong

A320

Dragonair

After three missed approaches due to lateral oscillations in turbulent conditions, a landing was made and the airplane went off the side of the runway. The flaps locked at 40 degrees deflection (landing position) just before the first go-around due to asymmetry. Asymmetry caused by rigging at the design tolerance combined with gust loads experienced. In accordance with published procedures, flightcrew selected CONF 3 for landing, which extended slats to 22 degrees. With autopilot engaged, lateral control laws correspond to control lever position. Under manual control, control laws correspond to actual flap/slat position. The configuration CONF 3, with flaps locked at 40 degrees, is more susceptible to lateral oscillations with the autopilot engaged. After a similar incident in November, 1993, experienced by Indian Airlines, Airbus issued an Operations Engineering Bulletin to leave the control lever in CONF FULL if the flaps lock in that position

4/26/94

Nagoya

A300-600

China Airlines

Flightcrew inadvertently activated the go-around switches on the throttle levers during a manually flown approach. This action engaged the autothrottles and put the flight guidance system in go-around mode. Flightcrew disconnected the autothrottles, but excess power caused divergence above the glide slope. Flightcrew attempted to stay on glide slope by commanding nose-down elevator. The autopilot was then engaged, which because it was still in go-around mode, commanded nose-up trim. Flightcrew attempted go-around after "alpha floor" protection was activated, but combination of out-of-trim condition, high engine thrust, and retracting the flaps too far led to a stall. Fatal crash.

6/21/94

Manchester

757-200

Britannia

Altitude capture mode activated shortly after takeoff, autothrottles reduced power, flight director commanded pitch-up before disappearing. Airspeed dropped toward V 2 before flightcrew pitched the nose down to recover.

6/30/94

Toulouse

A330

Airbus

Unexpected mode transition to altitude acquire mode during a simulated engine failure resulted in excessive pitch, loss of airspeed, and loss of control. Pitch attitude protection not provided in altitude acquire mode. Fatal crash.

9/24/94

Paris - Orly

A310-300

Tarom

Overshoot of flap placard speed during approach caused a mode transition to flight level change. Autothrottles increased power and trim went full nose-up for unknown reasons (autopilot not engaged). Flightcrew attempted to stay on path by commanding nose-down elevator, but could not counteract effect of stabilizer nose-up trim. Airplane stalled, but was recovered.

10/31/94

Roselawn

ATR-72

American Eagle

In a holding pattern, the airplane was exposed to a complex and severe icing environment, including droplet sizes much larger than those specified in the certification requirements for the airplane. During a descending turn immediately after the flaps were retracted, the ailerons suddenly deflected in the right-wing down direction, the autopilot disconnected, and the airplane entered an abrupt roll to the right. The flightcrew were unable to correct this roll before the airplane impacted the ground.

3/31/95

Bucharest

A310-300

Tarom

Shortly after takeoff in poor visibility and heavy snow, with autothrottles engaged, climb thrust was selected. The right engine throttle jammed and remained at takeoff thrust, while the left engine throttle slowly reduced to idle. The increasing thrust asymmetry resulted in an increasing left bank angle, which eventually reached about 170 degrees. The airplane lost altitude and impacted the ground at an 80-degree angle. Only small rudder and elevator deflections were made until seconds before impact, when the left throttle was brought back to idle to remove the thrust asymmetry. Fatal crash.

11/12/95

Bradley International Airport

MD-80

American Airlines

On a VOR-DME approach, the airplane descended below the minimum descent altitude, clipped some trees, and landed short of the runway. Contributing to this incident was a loss of situation awareness and terrain awareness by the flightcrew, lack of vertical guidance for the approach, and insufficient communication and coordination by the flightcrew.

12/20/95

Cali

757-200

American Airlines

Unexpectedly cleared for a direct approach to Cali, the flightcrew apparently lost situation awareness and crashed into a mountain north of the city. On approach, the flightcrew were requested to report over Tulua VOR. By the time this waypoint was input into the flight management computer, the airplane had already flown past it; the autopilot started a turn back to it. The flightcrew intervened, but the course changes put them on a collision course with a mountain. Although the ground proximity warning system alerted the flightcrew, and the flightcrew responded, they neglected to retract the speedbrakes and were unable to avoid hitting the mountain. Fatal crash.

2/6/96

Puerto Plata

757-200

Birgenair

After taking off from Puerto Plata, the flightcrew lost control of the airplane during climb and crashed into the ocean off the coast of the Dominican Republic. Problems with the captain's airspeed indication were encountered during the takeoff roll, and the takeoff and initial climbout were conducted using airspeed callouts by the first officer. Continued erroneous airspeed indications, possibly due to a blocked pitot tube, resulted in an overspeed warning during climb. Shortly thereafter the stickshaker activated. The conflicting warnings (overspeed and stall) apparently confused the flightcrew. The airplane entered a stall from which it did not recover. Fatal crash.